{"api_version":"1","generated_at":"2026-08-22T00:30:31+00:00","cve":"CVE-2026-76227","urls":{"html":"https://cve.report/CVE-2026-76227","api":"https://cve.report/api/cve/CVE-2026-76227.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76227","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76227"},"summary":{"title":"Renovate 42.68.1 before 42.96.3 Environment Variable Exposure","description":"Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.","state":"PUBLISHED","assigner":"VulnCheck","published_at":"2026-08-19 14:17:49","updated_at":"2026-08-19 14:17:49"},"problem_types":["CWE-526","CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable"],"metrics":[{"version":"4.0","source":"disclosure@vulncheck.com","type":"Secondary","score":"6.8","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"6.8","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","data":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"}},{"version":"3.1","source":"disclosure@vulncheck.com","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure","name":"https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf","name":"https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76227","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76227","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 42.96.3 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 42.68.1 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 43.4.4 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"affected 13.3.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"renovatebot","product":"renovate","version":"unaffected 13.6.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"viceice","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/renovate","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"42.96.3","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"42.96.3","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:npm/renovate","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"43.4.4","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"43.4.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"42.96.3","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"42.96.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"43.4.4","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"43.4.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"42.96.3","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"42.96.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"43.4.4","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"43.4.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"42.96.3","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"42.96.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"43.4.4","status":"affected","version":"42.68.1","versionType":"semver"},{"status":"unaffected","version":"43.4.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"renovate","vendor":"renovatebot","versions":[{"lessThan":"13.6.0","status":"affected","version":"13.3.0","versionType":"semver"},{"status":"unaffected","version":"13.6.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"viceice"}],"datePublic":"2026-02-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment."}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-526","description":"Cleartext Storage of Sensitive Information in an Environment Variable","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T14:02:09.384Z","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck"},"references":[{"name":"GitHub Security Advisory (GHSA-8wc6-vgrq-x6cf)","tags":["vendor-advisory"],"url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf"},{"name":"VulnCheck Advisory: Renovate 42.68.1 before 42.96.3 Environment Variable Exposure","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure"}],"title":"Renovate 42.68.1 before 42.96.3 Environment Variable Exposure","x_generator":{"engine":"vulncheck-endgame"}}},"cveMetadata":{"assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","assignerShortName":"VulnCheck","cveId":"CVE-2026-76227","datePublished":"2026-08-19T14:02:09.384Z","dateReserved":"2026-08-19T11:36:02.573Z","dateUpdated":"2026-08-19T14:02:09.384Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 14:17:49","lastModifiedDate":"2026-08-19 14:17:49","problem_types":["CWE-526","CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable"],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76227","Ordinal":"1","Title":"Renovate 42.68.1 before 42.96.3 Environment Variable Exposure","CVE":"CVE-2026-76227","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76227","Ordinal":"1","NoteData":"Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.","Type":"Description","Title":"Renovate 42.68.1 before 42.96.3 Environment Variable Exposure"}]}}}